ClawHub
Back to skill

Security audit

Google Sheets File Automation

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Google Sheets automation guide with expected authentication and write capabilities, but users should treat its CLI dependency and Drive token scope carefully.

Install only if you trust the porteden CLI source, prefer a pinned or reviewed version where possible, and authenticate with a dedicated Google account or profile that can access only the spreadsheet workspace this automation needs. Use append for new rows, require confirmation before overwriting ranges, and log out or remove persisted credentials when finished.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:14
Finding

Unpinned Third-Party CLI Dependency

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 7 and 14
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

yaml
metadata: {"openclaw":{"emoji":"🤖","homepage":"https://porteden.com","requires":{"bins":["porteden"]},"primaryEnv":"PE_API_KEY","envVars":[{"name":"PE_API_KEY","required":false,"description":"API key; if unset, credentials are read from the system keyring via `porteden auth login`"},{"name":"PE_SHEET_ID","required":false,"description":"Target spreadsheet ID; if unset, the skill finds the sheet by name (see body)"}],"install":[{"id":"brew","kind":"brew","formula":"porteden/tap/porteden","bins":["porteden"],"label":"Install porteden (brew)"},{"id":"go","kind":"go","module":"github.com/porteden/cli/cmd/porteden@latest","bins":["porteden"],"label":"Install porteden (go)"}]}}
markdown
If `porteden` is not installed: `brew install porteden/tap/porteden` (or `go install github.com/porteden/cli/cmd/porteden@latest`).

Technical Analysis

The Go installation source uses the mutable @latest version selector. Consequently, the executable installed by a user is not tied to the version that was reviewed during this audit. A future upstream release or compromise of the upstream repository can silently alter the effective behavior of the skill without requiring any change to SKILL.md.

The alternative Homebrew command also installs from a custom third-party tap without specifying a reviewed version or requiring checksum or signature verification. Although the third-party source is disclosed and appears related to the documented project, the installation instructions do not establish artifact integrity.

This is a supply-chain weakness rather than evidence that the currently documented dependency is malicious.

Attack Path

  1. An attacker compromises the upstream Go repository, its release process, or the custom Homebrew tap.
  2. The attacker publishes a modified release or formul ...[truncated 1260 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace @latest with a specifically reviewed semantic version or immutable commit reference, for example:

    bash
    go install github.com/porteden/cli/cmd/porteden@vX.Y.Z

  2. Record and verify trusted release checksums or cryptographic signatures before installation.

  3. Pin the Homebrew formula to a reviewed version where supported, and verify the provenance and integrity of the custom tap.

  4. Use automated dependency monitoring to identify security advisories, but update the pinned version only after review and testing.

  5. Run the CLI under a dedicated, least-privileged account and profile with access only to required spreadsheets.

  6. Avoid exposing credentials unnecessarily through process environments, and retain the documented recommendation to use narrowly scoped authentication.

  7. Document the exact reviewed CLI version in the skill metadata so users can reproduce the audited installation.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.

md
name: sheets-writer
description: Google Sheets Data Writer. Use when the user wants to append rows, update cells, or automate spreadsheet data pipelines against a pre-configured target sheet.
version: 1.0.8
metadata: {"openclaw":{"emoji":"🤖","homepage":"https://porteden.com","requires":{"bins":["porteden"]},"primaryEnv":"PE_API_KEY","envVars":[{"name":"PE_API_KEY","required":false,"description":"API key; if unset, credentials are read from the system keyring via `porteden auth login`"},{"name":"PE_SHEET_ID","required":false,"description":"Target spreadsheet ID; if unset, the skill finds the sheet by name (see body)"}],"install":[{"id":"brew","kind":"brew","formula":"porteden/tap/porteden","bins":["porteden"],"label":"Install porteden (brew)"},{"id":"go","kind":"go","module":"github.com/porteden/cli/cmd/porteden@latest","bins":["porteden"],"label":"Install porteden (go)"}]}}
---

# porteden sheets-writer

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

md
name: sheets-writer
description: Google Sheets Data Writer. Use when the user wants to append rows, update cells, or automate spreadsheet data pipelines against a pre-configured target sheet.
version: 1.0.8
metadata: {"openclaw":{"emoji":"🤖","homepage":"https://porteden.com","requires":{"bins":["porteden"]},"primaryEnv":"PE_API_KEY","envVars":[{"name":"PE_API_KEY","required":false,"description":"API key; if unset, credentials are read from the system keyring via `porteden auth login`"},{"name":"PE_SHEET_ID","required":false,"description":"Target spreadsheet ID; if unset, the skill finds the sheet by name (see body)"}],"install":[{"id":"brew","kind":"brew","formula":"porteden/tap/porteden","bins":["porteden"],"label":"Install porteden (brew)"},{"id":"go","kind":"go","module":"github.com/porteden/cli/cmd/porteden@latest","bins":["porteden"],"label":"Install porteden (go)"}]}}
---

# porteden sheets-writer

Credential Access

High
Category
Privilege Escalation
Confidence
86% confidence
Finding

This section explicitly acknowledges that a Drive-enabled token inherits the connected Google account's broader Drive reach, not just the configured sheet. In an agent-executed skill, that creates real over-privilege risk: a compromised or misdirected agent action could access or modify other reachable spreadsheets and Drive content beyond the intended target.

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

md
### 1. Authenticate (once)

- **Browser login (recommended):** `porteden auth login` — opens browser, credentials stored in system keyring
- **Direct token:** `porteden auth login --token <key>` — stored in system keyring
- **Verify:** `porteden auth status`
- If `PE_API_KEY` is set in the environment, the CLI uses it automatically (no login needed).
- Drive access requires a token with `driveAccessEnabled: true` and a connected Google account with Drive scopes. Prefer a Google account that only has access to the target spreadsheet/workspace — token authority extends to whatever that account can reach.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.

md
# porteden sheets-writer

Automate Google Sheets updates with `porteden sheets`. This skill configures a **target spreadsheet** via environment variable so agents can append rows and write data without repeating the file ID. **Use `-jc` flags** for AI-optimized output.

If `porteden` is not installed: `brew install porteden/tap/porteden` (or `go install github.com/porteden/cli/cmd/porteden@latest`).

Static analysis

No suspicious patterns detected.